1. Scope & Application
This Policy applies to all personal data processed by Cenvexa in connection with our products, websites, applications, services and related business operations worldwide. It also applies to personal data collected offline (for example through support or recruitment).
We seek to comply with the Information Technology Act, 2000, the IT (SPDI) Rules, 2011, and, where applicable, the Digital Personal Data Protection Act, 2023 (DPDP Act), and other relevant data protection laws. The competent courts of Kolkata, West Bengal, India have exclusive jurisdiction for disputes arising under this Policy (see Section 13).
2. Definitions
- "Personal Data": any information relating to an identified or identifiable natural person.
- "Sensitive Personal Data": categories such as financial, health-related, authentication data or other categories identified under applicable law.
- "Processing": any operation performed on Personal Data (collection, storage, use, disclosure, deletion, etc.).
3. Information We Collect
3.1 Personal information you provide
- Contact details: name, email address, phone number;
- Account details: username, profile information, authentication credentials;
- Financial/payment information: card or payment instrument details (processed by trusted third-party payment processors: we do not store full card data);
- Service content: expense records, group membership and shared data you enter into the product;
- Recruitment data: resumes, interview notes, references (when you apply for roles);
- Support and correspondence: messages, attachments and other information you submit to us.
3.2 Information collected automatically
- Technical identifiers: IP address, device identifiers, operating system, browser type;
- Usage data & telemetry: pages visited, features used, event logs and performance metrics;
- Diagnostics: crash reports and error logs;
- Location information: when you grant permission (coarse or precise as applicable);
- Cookies and similar technologies (see Section 9).
4. Purpose of Processing
We process Personal Data for the following primary purposes:
- To provide, maintain, and improve our services and user experience;
- To process transactions and related communications;
- To operate support, onboarding and administrative processes;
- To detect, prevent and investigate fraud, abuse and security incidents;
- To personalise product features and communication (subject to your choices);
- To comply with legal obligations and contractual commitments.
5. Lawful Basis & Consent
Where required by law, we rely on a lawful basis for processing (e.g. consent, performance of contract, legal obligation, legitimate interests). For certain categories of processing (e.g. marketing or access to sensitive categories) we will request explicit consent where required by applicable law.
7. Data Security
We implement reasonable technical, administrative and physical safeguards, including but not limited to:
- Encryption in transit (TLS) and at rest for sensitive elements where applicable;
- Access controls and role-based permissions;
- Regular security testing, audits and vulnerability management;
- Incident response and data breach notification procedures;
- Secure development lifecycle practices and employee security training.
Although we strive to protect Personal Data, no security measure is perfect and we cannot guarantee absolute security.
8. Data Retention
We retain Personal Data only for as long as necessary to fulfil the purposes set out in this Policy, to satisfy legal or regulatory obligations, and to resolve disputes.
Typical retention periods (subject to specific legal requirements):
- Account and profile data: until account deletion + 30 days;
- Expense transaction records: until account deletion + 7 years (for tax and audit purposes);
- Support correspondence: 3 years;
- Analytics data: retained in anonymized or aggregated form after 2 years.
10. International Transfers
We may transfer Personal Data to countries outside your jurisdiction for processing. When transfers occur, we implement appropriate safeguards such as:
- Standard contractual clauses or equivalent contractual protections;
- Transfers to jurisdictions with adequacy findings (where applicable);
- Vendor agreements that include required protections.
11. Children's Privacy
Our products and services are not intended for children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect Personal Data from children. If you believe we have collected a child's data, contact us immediately and we will take steps to remove it.
12. Your Rights & Requests
Subject to applicable law, you may have rights including:
- Access: obtain a copy of Personal Data we hold about you;
- Rectification: request correction of inaccurate or incomplete data;
- Erasure: request deletion of Personal Data (subject to legal exceptions);
- Portability: receive your Personal Data in a commonly used format;
- Restriction/Objection: ask us to restrict or object to certain processing; and
- Withdraw Consent: where processing is based on consent you may withdraw it.
To exercise these rights contact: team@cenvexa.com. We may ask for identity verification and will respond within the timeframes required by applicable law.
13. Governing Law & Dispute Resolution
This Policy is governed by the laws of the Republic of India. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts located in Kolkata, West Bengal, India.
14. Changes to This Policy
We may update this Policy to reflect legal, technical or business developments. For material changes we will provide notice (e.g., email or in-app notice) at least 30 days before the change becomes effective. Your continued use of the Services after publication constitutes acceptance of the updated Policy.
15. Contact & Data Protection Officer
For questions, to exercise your rights, or to report a privacy concern, contact:
Data Protection / Privacy Team
Email: team@cenvexa.com